Announcement

Collapse
No announcement yet.

Nightly Site Attack

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Nightly Site Attack

    Hello,

    I have a board, and between 6.30 - 7PM the site under goes an attack (not sure the type of attack), but around a month ago the site underwent a dos attack direct to this site, and now every night between the above times the server hits 50-90CPU.

    This lasts around 15-30 min's, I've tried a dedicated server and it had the same problem's.


  • #2
    Who are you hosted with? You should contact your DC

    Comment


    • #3
      Does your traffic usage also go up during that time? If so, you probably have a worm / whatever on your server that is attacking other servers.

      Comment


      • #4
        It happens on every site, could the board have caught something at all. I moved host twice in 2 days

        Datacentre couldn't do anything either. All I receive from hosts is that the CPU goes up between these times


        I have tried coreix, interserver and theplanet
        Last edited by rh2004; Sun 20 Mar '05, 3:49pm.

        Comment


        • #5
          One thing that comes to mind are the vB cronjobs executing scripts at those times when it's likely not the server itself causing this. Try looking through them and see if there's something unusual?

          Comment


          • #6
            Yeah but to take a CPU upto this level on a cronjob takes just a bit.

            What can I do to work this out, because im totally amazed
            Last edited by rh2004; Mon 21 Mar '05, 3:19am.

            Comment


            • #7
              Do you have any server cron jobs running during that time?
              Steve Machol, former vBulletin Customer Support Manager (and NOT retired!)
              Change CKEditor Colors to Match Style (for 4.1.4 and above)

              Steve Machol Photography


              Mankind is the only creature smart enough to know its own history, and dumb enough to ignore it.


              Comment


              • #8
                No cron jobs running on any of the servers

                Comment


                • #9
                  RH, do you have any security measures in place? Firewall? AntiDDOS? Bruteforce protection?

                  Comment


                  • #10
                    Yes but I'm talking about third party hosts at the moment, now I did notice quite an increase in CPU yesterday shortly after uploading the database and enabing the site.

                    So where do I look, or start to look to find out the problem. I don't think I saw anything different or unusual when I looked at the vb cron's

                    Comment


                    • #11
                      Here are the vb cron's
                      Attached Files

                      Comment


                      • #12
                        The vB crons would not cause this. Personally I think the most likely cause is s some server cron jobs since the timing is the same every day, but you said you have ruled that out.
                        Steve Machol, former vBulletin Customer Support Manager (and NOT retired!)
                        Change CKEditor Colors to Match Style (for 4.1.4 and above)

                        Steve Machol Photography


                        Mankind is the only creature smart enough to know its own history, and dumb enough to ignore it.


                        Comment


                        • #13
                          Yes I am going to try and scrap everything and start with a new import as the board is still on 3.0.3, I am unable to see the Import / Export when I uploaded the impex to /impex

                          If I type /impex/ I receive a white page.

                          Comment


                          • #14
                            I thought you were on a dedicated server?

                            If you are, have you installed a good firewall and Bruteforce system?

                            Comment


                            • #15
                              That was a number of month's ago It had a direct dos attack so I moved to shared since

                              And yes the dedicatd has the above

                              Comment

                              widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
                              Working...
                              X